Re:I Hacked into Facebook's Legal Department Admin Panel
by byecomputer on Monday December 14, 2020 @08:33AM
(#25417282)
Negotiating is above-board in its own right, which means you've got the right to say, "No, that price is too low," and walk away from the exchange. But, in a broad sense, I'd argue it becomes an issue when you say, "If you don't pay me, I'm going to facilitate crime with this data (or at least make it easy for others to do so)!" Because it's contemptuous of the law—not to mention it's a power dynamic that can really jeopardize a person's agency and certainly leads us to a more corrupt society if it's not acknowledged formally for being untoward.
But I also think a lot of these companies are happy to frame negotiations as extortionate if someone has the audacity to counter their offer, and that's bullshit. But it would also be bullshit to try to drive up the price on a real bounty after the fact by threating to let the bountied person run free with a map to your house, so it's complicated and I can see the precedent in thought there.
Re:I Hacked into Facebook's Legal Department Admin Panel
by tw47ddfdf1a705 on Monday December 14, 2020 @08:52AM
(#25417472)
Publicly releasing a vulnerability is not a crime, even if FB would prefer I didn't.
Re:I Hacked into Facebook's Legal Department Admin Panel
by byecomputer on Wednesday December 16, 2020 @02:16AM
(#25439921)
Threatening it as consequence of non-payment is, though. The nature of blackmail is weird, it gets written about a lot.
Re:I Hacked into Facebook's Legal Department Admin Panel
by asdfasgasdgasdg on Monday December 14, 2020 @09:01AM
(#25417578)
The facilitation the gp was referring to was what would be done with the vulnerability after it was publicly released.
Now a more relevant example:
I discovered a security vulnerability in FB.
1. Publish the vulnerability publicly (legal)
2. Sell the vulnerability to exploiters (illegal)
3. Accept FB's bug bounty reward (legal)
4. Attempt to negotiate a different amount with FB, falling back to #1 (illegal, blackmail)
5. Attempt to negotiate a different amount with FB, falling back to #2 (illegal, extortion)
6. Attempt to negotiate a different amount with FB, falling back to #3 (legal)
I assert that treating #4 as a crime is to use the police powers of the state to protect FB's wallet.